XMPP Network Domain Spoofing Vulnerability in Prosody Server
CVE-2016-0756

5.3MEDIUM

Key Information:

Vendor: Prosody
Status: Prosody
Vendor: CVE Published:; 29 January 2016

What is CVE-2016-0756?

The Prosody XMPP server's mod_dialback module contains a vulnerability in its generate_dialback function, where it fails to adequately separate fields when generating dialback keys. This flaw permits remote attackers to craft specific stream IDs and domain names, enabling them to successfully spoof XMPP network domains. The issue affects versions prior to 0.9.10, making it crucial for users to update to secure the server against potential exploitation.